ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Client-side encryption ensures that data is encrypted before it enters the provider's environment, so only ciphertext is stored in the object store. Generating and retaining the master keys in an on-premises hardware security module (HSM) enforces strict separation of duties, because provider administrators never have access to the keys. Because the customer exclusively controls the keys, they can delete them at contract termination, achieving cryptographic erasure. Provider-managed keys cannot guarantee provider inaccessibility, snapshots alone do not deliver encryption or crypto-erase capability, and simple data masking leaves confidential values recoverable from the backups.